The Risk of Storing Your Funds on Centralized Exchanges

[I_Anime]

So I was just online doing my usual activity , then this warning message popped up from a friend .  Saying that his friend  Bybit was compromised, I had to ask him in his private dm how did it happened he was like they login with his email . Now there’s nothing they can do , this is the reason why keeping your assets in exchanges is not encouraging at all , and we can never emphasize on that enough . Because many will keep falling for it , there are various way they can access your account , ways like ; phishing , Sim swapping , malware , Malicious API keys ,Fake customer support (I’ve mentioned a friend that also fell for this ) e.t.c.

This doesn’t mean exchanges are automatically unsafe. They also play vital role in this space by like  making  buying, selling and trading crypto much easier. However, always remember that “NOT YOUR KEYS NOT YOUR COINS “ keeping all your assets on a centralized platform means you are trusting a third party to safeguard your funds. Longterm assets is better kept in a Noncustodial wallet , also avoid using same password in different platform , enable strong 2FA, and always Review Your API Permissions e.t.c. Further research on how to keep your assets safe .

[Frankolala]

Your friend didn't enable his 2FA which is the cause of his Bybit account being compromised. This is why it's good to enable 2FA and use different device for your google authenticator so that, if someone have access to your email, he wouldn't have access to your google authenticator. However, only keep what you can afford to lose in an exchange even though, you are a trader and store your major funds in a self custody wallet.

[Doan9269]

If you are new to cryptocurrency then know that there is risk having your assets on a centralized exchanges, it is better for you to have your private key and seat phrase to give you control over your coins and you could always get to have access at anytime, non-custodial storage is more preferred than any other means of holding your assets in cryptocurrency, anyone that goes through the learning parts will understand the need to this.

[Hypnotizer]

This particular risks doesn’t apply to only Centralized Exchanges alone, it’s Wallet or account compromise and it can happen anywhere if the holder is not due diligent, but compromises are much easier on Centralized exchanges or platforms than Self-Custody Wallet.

There are lot of practices that could have made his account more secured on the exchange, just as the first reply above has mentioned, 2FA could have somehow  prevented this.

Nevertheless, we should not keep our funds in exchange and exchange should be used for their main purpose which is just to exchange or convert coins and also we need to be more diligent about our accounts and wallet.

[Moreno233]

Despite the coldcard vulnerability,  we should not think that the term "not your keys, not your coins" is now meaningless because it isn't.  Storing funds in exchange is one of the worst mistake anyone can make because it is risky as we have seen what happened to people that had their money in Bitmart. The case you described here is surprising to me though because someone that uses 2FA is not supposed to be a victim unless the exploit is from compromise from the part of the exchange and not the mistake of their user. Soon I'm sure they will sent memo to clarify this because it is not looking good for them.

[Charles-Tim]

Your topic title is confusing, this thread is not about the risks of storing funds on centralized exchanges, it is about someone's negligence that make him give his login details to an unknown person which is a scammer or a hacker. That is not Bybit's fault, but the fault of the person that his exchange account was compromised.

But I think Bybit supposed to have made 2FA compulsory. Although, that does not mean the person may not also give the scammer or hacker the 2FA OTP if he can give other login details to a stranger.

[Hyphen(-)]

This doesn’t mean exchanges are automatically unsafe. They also play vital role in this space by like  making  buying, selling and trading crypto much easier. However, always remember that “NOT YOUR KEYS NOT YOUR COINS “ keeping all your assets on a centralized platform means you are trusting a third party to safeguard your funds. Longterm assets is better kept in a Noncustodial wallet , also avoid using same password in different platform , enable strong 2FA, and always Review Your API Permissions e.t.c. Further research on how to keep your assets safe .

Exchanges are actually not safe, you can’t rely on them to keep your money with them. The best thing is to use them for their purpose which is to exchange crypto, buy and sell, and maybe convert to fiat and so on. Unless if you want to trade, you can use the exchange to trade futures and maybe spot trading but always move your coin out of the centralized exchange to your personal wallet that you have your private key in your possession, so that all these stories of hacking into your account will not reach your side.

If you still want to use exchange for trading, make sure you use 2FA security to safeguard your exchange to avoid being hacked once someone have access to your email address. The 2FA will help to provide external security for your exchange account.

[Ambatman]

Person that made such mistake
Would fall easily in losing their seedphrase to scammers
Or they won't even back up their seedphrase and believe the wallet is safe on their device.

there are various way they can access your account , ways like ; phishing , Sim swapping , malware , Malicious API keys ,Fake customer support

Non custodial wallet can experience any of these
This isn't on exchanges.
When there's a breached or an exchange freeze your account that's when we say exchange.

[Davidloki]

He lost his funds to scammers because his security measures were poor. I use 2FA and passkey verification for my central exchanges. Even if someone has access to my email, he can't use my email and phone number to get access to my account.

Personal security is very important. Your friend gave his device out. It was a well-planned attack on him. In this life, there is nothing that will push me to give someone my device. I don't do all those hep me with your phone shit.

[Shadiq]

This was the result of your friend's carelessness, even a self-custody wallet can be hacked if proper security measures are not taken. I see no reason to blame the centralized exchange in this incident. You are right that you should not keep long-term funds in a centralized exchange, but I do not see any connection between centralized and decentralized with your friend's incident.

You can blame the centralized exchange only when the entire exchange gets hacked or is a victim of fraud, but when only you are the victim of a hack, consider that there is a flaw in your security system. If there is a security flaw, any of your accounts can be hacked, and you are to blame for this. When using crypto, you always have to ensure 100% security, then there is a risk of trusting a third party. But if 100% security is ensured in a decentralized wallet, there is no risk of trusting a third party.

[Gost ms]

Awareness is one of the biggest tools every hacker can use to protect themselves from hackers. People who are not aware and easily click on links and do other things are always the victims of hacking. If your friend had taken all the precautions, he might not have faced such a problem. For example, he might have refrained from enabling 2FA and other security features, which is why he easily became a victim of hacking.

Before clicking on any link, it is necessary to properly research whether there is any malware or viruses in this link. It is best for each person to find a decentralized wallet and keep his holdings in that wallet. Keeping Bitcoin in an exchange is never a good idea.

[MainIbem]

Apart from not supporting self custody which is the best way of holding Bitcoin, exchanges are not very secured from hackers and should be totally avoided for people who chose  holding Bitcoin for long term. It doesn't also mean that traders should ge conscious of their security too cause losing funds no matter how small it may be is very painful so people who use Bybit platform for trading should use an authenticator to secure their account.

[casey15]

I think the friend that got his assets wiped didn't secure his account enough. If 2FA was active, I think it wouldn't be that easy for them to take his funds.
Centralised exchanges have their drawback... One thing I've said here before is the fact that people rather choose convenience over security. Exchange makes it easy to keep your assets especially when they are multiple in one place. A lot of decentralised wallet and exchange have made user experience better but then it is still difficult for people to fully transition to them.
I think that friend should learn to practice more security practices and should know that exchanges are not 100% safe... In fact they are a major target because they deal with funds

[Judith87403]

With the rate of scams currently, everyone is supposed to activate 2FA in their exchange account because i don't really know what scammers are trying to turn into. Just one mistake can be very costly, and your coins can be stolen. Many times it has been discussed thar exchanges are not safe to store crypto assets, it shouldn't be stressful to move your funds from self custody wallets to your exchange wallets. You don't need to worry about the transaction fees that you will have to pay each time you are moving funds from exchange to self custody wallets and vice versa, if you are a trader. Don't think because you will need funds to do a trade and forget the vulnerability of exchanges. Do anything you can to secure and protect your money from hackers because it is very painful when you lose your crypto to some jobless hackers online.

[Cryptomultiplier]

A lot of us use BYBiT and trust the platform that it is secure to some extent, but that isn't to say that ensuring our own security isn't a major concern, because as the saying implies, 'not your keys, not your coins,' is the core truth about using CEX in this day and time when hackers and scammers and even friends and family can easily gain access to your account and do as they please with it.

One thing I also fear about CEX is when they advertise users to leave some certain amount of coins on the exchange for a certain duration to earn some percentage as profit, I don't fall for it. I only leave funds I am going to use almost immediately or in the next few days to trade with otherwise, my funds are transferred to my bank account or to a hardware wallet ASAP without thinking so much about it.
I also try as much to rid my emails of login details or transactions details on CEX or even from my banks because we don't know who can have access at any time.

[osasshem]

This is a serious problem that has to be taken seriously by everyone who is in this crypto industry. The popular and well known to be the most secured wallets has faced exploits, that's to say the rate of more attacks on every crypto platforms may as well increase.

This doesn’t mean exchanges are automatically unsafe. They also play vital role in this space by like  making  buying, selling and trading crypto much easier. However, always remember that “NOT YOUR KEYS NOT YOUR COINS “ keeping all your assets on a centralized platform means you are trusting a third party to safeguard your funds. Longterm assets is better kept in a Noncustodial wallet , also avoid using same password in different platform , enable strong 2FA, and always Review Your API Permissions e.t.c. Further research on how to keep your assets safe .

Does he use the website when accessing the exchange or he uses the mobile app? I think the use of mobile app is a bit more safer than using the website, because the mobile applications faces more updates and bug fixes, unlike the websites, and the websites are what can be injected. But if it is through the mobile app, it simply means the person who did this to him is not fair away.

[Amphenomenon]

Your friend didn't enable his 2FA which is the cause of his Bybit account being compromised. This is why it's good to enable 2FA and use different device for your google authenticator so that, if someone have access to your email, he wouldn't have access to your google authenticator. However, only keep what you can afford to lose in an exchange even though, you are a trader and store your major funds in a self custody wallet.

You share a good point here but the thing is 2FA won't save or help for everything. While most exchanges including Bybit finds ways to make this mandatory and I'm curious about how the entire scam process went, eespecially if the victim had a 2FA, there are still a number of attacks individuals can fall into while using exchanges.

[Audrey Simmons]

This doesn’t mean exchanges are automatically unsafe. They also play vital role in this space by like  making  buying, selling and trading crypto much easier. However, always remember that “NOT YOUR KEYS NOT YOUR COINS “ keeping all your assets on a centralized platform means you are trusting a third party to safeguard your funds. Longterm assets is better kept in a Noncustodial wallet , also avoid using same password in different platform , enable strong 2FA, and always Review Your API Permissions e.t.c. Further research on how to keep your assets safe .

Exchanges are unsafe for holding, anybody storing their assets in a centralized exchange is going to find it difficult to accept their losses if perhaps, something happens to the exchange or scammers gain access to their login information.

Long term assets are better held in non-custodial, open-source, and reputable wallets, in a point of fact long term assets should be better held in a cold storage system, and every appropriate effort to protect and secure the assets should be properly made to avoid the risks of losing them.

[Antidote47k]

Although I agree that exchanges aren’t recommended for long term storing of bitcoin, I don’t think this particular case fully embodies the risk you’re describing.
According to you, the person's Bybit account was compromised because someone gained access to the person's email, so the issue was from the person failing to safeguard his logins, and not a typical case of Bybit taking custody of his bitcoin and failing to safeguard it.

I still agree with your general point of exchanges not being a good option for storing bitcoin, I do think that the stronger argument against that would be the custodial risk itself, I.e even if your account is secure, you’re essentially still trusting the exchange to hold your coins and still trusting them to allow you to withdraw at any given time. If peradventure the exchange gets hacked or runs out of money, or if it freezes withdrawals or otherwise has an issue, you have no direct control over the coins.

[promise444c5]

Logged in with his email like they hijacked his email account ? Because that’s the only way they can get through if eventually OP is also using same email  on  a cloud TOTP authenticator service like Google..  even when a 2FA is enabled for an account.

Email verification are usually required when signing in from a new unrecognized device though … could depend on the CEX too .

So there’s a lot of possibilities here..